| <!DOCTYPE html> |
| <html> |
| WebKit Bug 89599 - Crash in LayoutBlockFlow::layoutPositionedObjects.<br /> |
| Test passes if it does not crash. |
| <style> |
| table { position: relative; } |
| .span:last-child { position: relative; } |
| </style> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| function crash() { |
| table = document.createElement('table'); |
| document.documentElement.appendChild(table); |
| |
| span1 = document.createElement('span'); |
| span2 = document.createElement('span'); |
| span3 = document.createElement('span'); |
| span3.setAttribute('class', 'span'); |
| span4 = document.createElement('span'); |
| span4.style.position = 'absolute'; |
| span3.appendChild(span4); |
| |
| table.appendChild(span1); |
| table.appendChild(span2); |
| table.appendChild(span3); |
| |
| document.documentElement.offsetTop; |
| span2.style.display = 'table-header-group'; |
| span3.style.display = 'block' |
| } |
| window.onload = crash; |
| </script> |
| </html> |
